How the ceremony works

1. Hold — deterministic risk rules

The rules engine scores every instruction 0–100 from amount × beneficiary-novelty × channel × urgency. Score ≥ 20 holds. Signals that hold on their own:

• Beneficiary is not in your vendor master (new vendor).
• Bank details differ from the last verified set.
• Instruction arrived over WhatsApp or voice — the Fideuram pattern.
• The message demands urgency ("wire it today").
• The sender doesn't match the known-good contact on file.
• Amount ≥ $10,000.

Same inputs, same verdict, every time. No ML, no voice detection, no guessing.

2. Callback — out-of-band, to the known-good number

Your team calls the number on file — never the number in the message — and records who called, when, and whether the confirmation code matched. WireWatch never calls anyone for you; it records your evidence.

3. Dual approval — two people, two devices

Release needs two approvals from different people on different devices. A single approver, or two approvals from one phone, cannot release. A reject blocks the payment.

4. Release — into a hash-chained ledger

Every step — hold, callback, approval, release — lands in a SHA-256 hash-chained audit ledger. Tamper-evident, exportable (Pro), and ready for your insurer or auditor.

Drill mode (Pro)

Run consent-based attack drills on your own team — fake CEO WhatsApp, vendor email change, urgent voice call:

• Fake CEO WhatsApp: A message arrives on WhatsApp claiming to be your CEO: 'Wire $48,500 to our new vendor today. Don't call me, I'm in a board meeting.' Walk the ceremony: who holds it, who calls back, who approves?
• Vendor bank-detail change by email: Your long-time vendor emails new bank details from a lookalike domain. The invoice looks right. Walk the ceremony before paying.
• Urgent voice call from 'the bank': A caller with your director's voice says the supplier changed banks and the wire must go out today. Walk the ceremony.

Drills score ceremony discipline: hold (+40), callback (+30), dual approval (+30).

Vendor master & imports

Keep known-good contacts in your vendor master. WireWatch stores only a SHA-256 hash of bank account numbers — never the numbers themselves. Pro plans can import vendors from a CSV (compatible with Xero/QuickBooks contact exports). This is a CSV import, not a live accounting sync.

What WireWatch does NOT do

• Detect deepfakes, cloned voices, or AI-generated text.
• Verify a bank account is real (your bank's job).
• Certify regulatory compliance or give legal advice.

Honest scope is the product. The ceremony is what stops the wire.